CVE-2026-41907 — Out-of-bounds Write in Uuid

CWE-787 — Out-of-bounds WriteCWE-823 — Use of Out-of-range Pointer Offset2 documents2 sources
Severity
8.1HIGHNVD
EPSS
0.0%
top 87.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Uuidjs Uuid
Timeline
PublishedApr 24

Description

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5uuidjs/uuid< 14.0.0

🔴Vulnerability Details

1
VulDB
uuidjs uuid up to 13.x out-of-range pointer offset↗2026-04-24
▶
CVE-2026-41907 — Out-of-bounds Write in Uuidjs Uuid | cvebase